Ueberlingen collision Trial started

[PBL]

Originally Posted by radicalrabit

surely a simple solution would have been if both aircraft had turned left even for a few seconds then they would have each headed away from the other? .......... Tell me why they couldnt have done that ?

There has been quite a considerable amount of research done on 3-dimensional collision avoidance algorithms.

Contrary to what you say, it is not simple.

Every collision could be avoided by some simple manoeuvre. The trick is to devise a simple manouvre which will avoid every collision, without introducing more dangers than it solves.

PBL

[Atishoo]

What happened to Mr Neilson?

[Tarq57]

What happened to Mr Neilson?

He was stabbed to death at his house by a relative whose family died in the TU154.
That man is currently serving a prison centre.
Mr Neilsen has been...I don't remember the exact word, but it amounts to exonerated,or absolved, more or less, at the recent legal proceedings.

Shame the world's media didn't follow up on the original story. Immediately after the crash, the media pretty much fingered Peter Nielsen as responsible. By the time it was starting to become clear that (of course) it was a little more complex than that, I guess the news was too boring for them.
Not that it would have made much difference, I guess. The poor relative was probably half crazy with grief by then, anyway.

But it might have.

[Frangible]

I differ with PBL on the likely causes of the Bashkirian crew’s decision to descend. My reading of the translation of the CVR is that they were in a simple dilemma about whether or not to obey the controller or TCAS. I don’t see any evidence for worries about two other aircraft in the Russian cockpit in the report or the CVR.

They chose to follow the controller instead of TCAS because their training on and experience of TCAS was very limited, and also because their manuals stated that a TCAS RA was a “recommendation” to the crew, not an absolute requirement. On the CVR the Russians don’t mention two other aircraft and when they see the DHL they only ever talk about “it”.

I don’t see how PBL can argue that the 10 o’clock versus 2 o’clock confusion was “crucial”. He says nothing to contradict the more obvious interpretation, which is that they were conflicted about what to do and made a bad choice.

PBL’s point 1 is strange. Is this really the TCAS “philosophy”? If that is printed somewhere, I would like to see it, as it seems a strange and illogical assertion for software experts to make. They are only dealing with their own system. ATC is another system. Where the designers, regulators and ICAO failed was in not emphasising strongly enough the dangers that would arise when both systems issued different orders to the aircraft at the same time.

As ATC Watcher pointed out before, when you translate the American “advisory” into other languages it often does not come out, as it should, as “command”. Secondly, there was little acount in TCAS’ implementation of the vital importance of stressing that you must never ever do the opposite of a TCAS RA. The strictures against this were well buried in the TCAS manual. Now, every pilot has burned into the brain, “Never manoeuvre contrary to an RA”, but before Ueberlingen, less careful airlines with less careful regulators and sketchy training regimes could fail to see the crucial importance of this rule.

I don’t mean to criticise PBL on the software and algorithms front. I haven’t the first notion about them, but I do think that the “three-aircraft scenario”, while of importance to flight safety was never a feature of Ueberlingen.

Finally, to say, as PBL does,

“I cannot think it wise to advise people to *always, without exception* follow an RA..”

is the height of irresponsibility. Perhaps not “follow”, but the golden rule of “Never manoeuvre contrary to an RA” is just that, golden, and to argue otherwise is very dangerous indeed. All sorts of incidents have been recorded where pilots thought their visual intepretation of a TCAS situation was better than the gizmo’s, and they were wrong every time. PBL’s comment is just the kind of thing that could possibly introduce doubt in the minds of pilots.

[visibility3miles]

What happened to Mr Neilson?

There was a thread about it when the person was sentenced for killing the controller:
http://www.pprune.org/forums/showthread.php?t=195886

[RatherBeFlying]

Managers have to pay court costs and damages to relatives

Les trois cadres devront participer aux frais de justice et payer un dédommagement aux proches des victimes. Quant au chef de projet qui avait coordonné les travaux d'entretien, en vacances la nuit du drame, il doit, également reconnu coupable, payer son manque de communication, entre autres auprès des centres de contrôle étrangers.

My first impression was that a suspended jail sentence does not count for much, but it looks like they're getting a severe kick in the wallet

[PBL]

Originally Posted by Frangible

I differ with PBL on the likely causes of the Bashkirian crew’s decision to descend.

I didn't say it was a likely cause. I said it was a rational choice.

Originally Posted by Frangible

I don’t see any evidence for worries about two other aircraft in the Russian cockpit in the report or the CVR.

I take it you didn't yet check Section 2.2.2 of the (english version of the) report, which says "According to CVR data it can be concluded that the instructor searched the airspace in front and to the right in vain."

Originally Posted by Frangible

PBL’s point 1 is strange. Is this really the TCAS “philosophy”? If that is printed somewhere, I would like to see it

For example, see Section 2.1, The Functional Requirement of Ed William's paper at
crpit.com/Vol47.html
I quote:
TCAS is a system of last resort and hence should have the following characteristics:
* Should only intervene when all "normal" means of separation have failed
........
* Should have minimal reliance on other systems
...

Section 2.2 elucidates the meanings of "normal" means and other systems.
My observation that ATC is considered to be "out of the picture" follows from this second stated requirement.

Originally Posted by Frangible

Finally, to say, as PBL does,
“I cannot think it wise to advise people to *always, without exception* follow an RA..”
is the height of irresponsibility.

Let me invent an acronym, HoI. People like to say "HoI this" and "HoI that" when talking about collision avoidance, as a way of trying to say they are worried about something. Well, it's good to be worried about something as important as collision avoidance, but it is not necessarily helpful to resort
to moral judgements in advance of having understood the technical claims.

Frangible, do you consider it HoI not to do a risk analysis on the situation of TCAS failing to resolve a conflict? Do you consider it HoI not to analyse the possible causal interactions between controller information and RAs?
If not (for extra credit ), why not?

Originally Posted by Frangible

All sorts of incidents have been recorded where pilots thought their visual intepretation of a TCAS situation was better than the gizmo’s, and they were wrong every time.

I infer that you know of lots of midair collisions in which pilots did not follow their TCAS advisory. I only know one.

If you think that pilots should always, without exception, follow the RA, would you change your mind if it turned out that the risk was relatively high that the TCAS algorithm could not resolve a given three-airplane conflict? If not (again, for extra credit), why not?

PBL

[Spuds McKenzie]

TCAS is a last resort tool, nothing more, nothing less.
If you use it correctly you're fine, if you don't, you're either lucky (like the DC10 and B747 crews over Japan on 31 January 2001, which missed each other by an estimated 60 meters, after, and this is very interesting, one of the crews decided to follow ATC instruction instead of TCAS) or you're not (like over Überlingen).

Fact is, if TCAS had not existed on 1 July 2002, there wouldn't have been a collision (the 757 would have maintained level, the TU154 would have flown underneath in descent as instructed).
So, since TCAS did exist, what would be the conclusion...

[PBL]

Originally Posted by Spuds McKenzie

Fact is, if TCAS had not existed on 1 July 2002, there wouldn't have been a collision

Yes. I am very glad to see that this straightforward observation is now becoming common currency.

Fact is that, had TCAS been available since 1950, it would have helped avoid four collisions in 36 years (Grand Canyon, Zagreb, San Diego, Cerritos). Since it was mandated (a matter of some 16 years in the U.S., less elswhere), use of TCAS has almost caused two collisions (Albany, NY, 1998, another three-aircraft situation; 28 June 1999 in Chinese airspace between BA027 and KE507) and been a contributory factor in one accident (Überlingen, as you point out). And that's just what I know about. Interestingly, the potential outcome at Albany was ameliorated through intervention of a controller, just the opposite of what is "supposed" to happen.

So, 4 in 36 years against 3 in 16 years. These figures are too sparse to draw any statistical conclusions. But they should suffice to indicate that the risk analysis is not at all obvious.

PBL

[Frangible]

Your first point. It may well have been a “rational choice”, but there is no evidence it is the one the Russians took, so you are only confusing matters by calling it “crucial”.

Your second point. If the instructor searched in vain, it does not mean he or the crew were confused, especially as they did not discuss it. It is entirely possible the instructor searched, found nothing, and concluded there was only one plane. However, they did debate whether to follow TCAS or ATC.

You are introducing the possibility of confusion by fastening on a speculative case rather than the actual, accepted case.

Your third point in fact supports my own. Your citation from the specs is undoubtedly correct, but banal. No TCAS design could possibly account for a factor completely extraneous to it, e.g. a controller getting on the horn and telling the crew to do the opposite of the TCAS instruction. It was the responsibility of the managers and regulators of air traffic control generally to demarcate the respective responsibilities of the controller and TCAS in all situations, and they failed to do that unambiguously.

If you say no “three-way” risk analysis has been performed then I would have to take your word for it, and maybe agree that it should be done if it hasn’t yet. I somehow doubt, however, that the risks here are not understood and have been ignored.

As for your final point about me possibly being aware of other midair collisions, you being only aware of one, I spoke of incidents only. The ACAS II bulletins have published case studies of TCAS encounters for several years.

One example was a 146 pilot who ignored his TCAS RA because the high angle of attack of the 747 he had visually acquired fooled him into believing it was climbing, when it was in fact descending. The result was a serious loss of separation. Same thing happened with the JAL 747 and the JAL DC10 over Japan when a pilot thought his visual information was superior to the TCAS RA. They missed by 10 metres.

I know that Eurocontrol carried out a large study of incidents involving non-compliance with TCAS and found other worrying incidents after Ueberlingen but they did not publish them because the study was done in co-operation with one particular airline under conditions of confidentiality (understandably).

I simply suggest that there have been rare cases where pilots thought they knew better than TCAS, and your remarks could encourage that tendency.

And you, incidentally, will acquire lots more credit if you drop the sarcasm.

[PBL]

Originally Posted by Frangible

Your first point. It may well have been a “rational choice”, but there is no evidence it is the one the Russians took,

Correct.

Originally Posted by Frangible

so you are only confusing matters by calling it “crucial”.

To date (five years), only a couple people have been confused.

Originally Posted by Frangible

Your second point. If the instructor searched in vain, it does not mean he or the crew were confused, especially as they did not discuss it.

He was the commander of the airplane. If he is looking for it, it means he thinks it might be there. If he thinks it might be there, it is reasonable to assume it will enter his decision-making (recall, he made the decision to continue to descend, against the query of the PF).

But you are right, and I emphasise again, that I am not attempting to *explain the actual decision*, merely to point out that it is a rational decision-theoretic choice.

Originally Posted by Frangible

You are introducing the possibility of confusion by fastening on a speculative case rather than the actual, accepted case.

I am analysing a specific scenario which is very, very close to the Überlingen scenario, if not identical with it.

This is exactly what hazard analysts do. This is what the laws of most countries require to be done before any piece of safety-related digital equipment such as TCAS is introduced into use.

If that introduces the "possibility of confusion", then so be it.

Originally Posted by Frangible

No TCAS design could possibly account for a factor completely extraneous to it, e.g. a controller getting on the horn and telling the crew to do the opposite of the TCAS instruction.

Now, you see, I don't believe that.

Hazard analysis *has to* account for factors completely extraneous to systems. That is what hazard analysis is.

Originally Posted by Frangible

It was the responsibility of the managers and regulators of air traffic control generally to demarcate the respective responsibilities of the controller and TCAS in all situations, and they failed to do that unambiguously.

Well, yes, but that is a separate issue. BTW, that demarcation is still ambiguous, and will remain so for the foreseeable future.

Originally Posted by Frangible

I somehow doubt, however, that the risks here are not understood and have been ignored.

On what basis do you doubt it?

Originally Posted by Frangible

I spoke of incidents only [rather than collisions].

I see. Maybe it wasn't clear to me what you were meaning to say. You said

Originally Posted by Frangible

.... incidents ...... where pilots thought their visual intepretation of a TCAS situation was better than the gizmo’s, and they were wrong every time.

You explain now:

Originally Posted by Frangible

I simply suggest that there have been rare cases where pilots thought they knew better than TCAS, and your remarks could encourage that tendency.

Well, you see, it is that "every time" that is problematic. There are a number of incidents in which the human interpretation was *in fact* better than that of TCAS.

Originally Posted by Frangible

you, incidentally, will acquire lots more credit if you drop the sarcasm.

Sorry you took it badly. I was trying to be humorous. I don't need the credit, thanks (or even the extra credit....).

Could you maybe actually answer the questions that the smileys were attached to? There is a reason I asked them.

PBL

[Frangible]

If you are really saying there are as many, or more, instances under TCAS version 7 where pilots’ instincts were right and the TCAS wrong, then we had all better stop flying right away.
It is axiomatic that with no TCAS, there would have been no collision. Equally, however, if there had been no ATC, and TCAS only, there would have been no collision. This is my point about demarcation – mix up the boundaries and you court disaster.
I suppose I reacted at first against some of what you were saying because it was by no means clear to me that you were using Ueberlingen as template onto which to put speculative scenarios. Now I see that, this debate becomes less interesting to me. You can call it simplistic, but I am in favour of preventing recurrences of that tragedy, and I don’t see how “decision-theoretics” are helping.
My bottom line, on which I will sign out on this palaver, is simply that you should not go around saying it is unwise to advise pilots always to follow the RA. If pilots fly contrary to the RAs, then TCAS becomes the cause of collisions and completely useless.

[Spitoon]

Originally Posted by PBL

Fact is that, had TCAS been available since 1950, it would have helped avoid four collisions in 36 years (Grand Canyon, Zagreb, San Diego, Cerritos). Since it was mandated (a matter of some 16 years in the U.S., less elswhere), use of TCAS has almost caused two collisions (Albany, NY, 1998, another three-aircraft situation; 28 June 1999 in Chinese airspace between BA027 and KE507) and been a contributory factor in one accident (Überlingen, as you point out). And that's just what I know about. Interestingly, the potential outcome at Albany was ameliorated through intervention of a controller, just the opposite of what is "supposed" to happen.

So, 4 in 36 years against 3 in 16 years. These figures are too sparse to draw any statistical conclusions. But they should suffice to indicate that the risk analysis is not at all obvious.

This is a rather simplistic analysis of the situation and it is at least reassuring that PBL does not try to draw any statistically based conclusions, albeit only for one of many reasons.

The reality is that the environment has changed significantly since 1950 and what may have happened then is not necessarily any indication of what might happen now or in the future (something that hazard analysts should think about). How much more traffic is around today compared to the 1950s? And how much have air traffic services changed? And how much have flightdecks changed? And the the operating procedures for modern aircraft? Making claims based on historical data in such a rapidly evolving environment is not for the faint-hearted!

Likewise, PBL's statistics are based on a sub-set of events in which TCAS may play a part. How many near misses occurred over the 36 years but were nothing more because of good fortune? And how many have been avoided in the 16 years because of increased situational awareness(although the accuracy of the information propvided by TCAS in this respect is often misunderstood) on the flightdeck?

Like so many other systems that we use today, TCAS provides benefits and creates hazards that would not otherwise have existed. Hazard analysis can help us to understand ways of managing risks - but it's not the panacea that some appear to think it is. It certainly doesn't guarantee that things won't be missed, that hazards won't evolve since the last analysis activity, or that the system will be used in the way that was originally intended.

The fact is that TCAS is here. With TCAS and countless other newly developed or evolving systems, we should learn lessons from previous (sadly sometimes tragic) experience. We should use it in the most effective way possible rather than trying to highlight supposed weaknesses and imply that this makes it a 'bad thing'.

By way of brief example,

[PBL]

Originally Posted by Spitoon

This is a rather simplistic analysis of the situation

Oh, good heavens, that isn't an analysis. It is a simple statement of fact.

I advise you to be careful of words like "simplistic". They can come back to bite you.

Originally Posted by Spitoon

Making claims based on historical data in such a rapidly evolving environment is not for the faint-hearted!

Indeed so. And so is making claims based on the ideas someone had of what is a close call. But that is all the data one has for judging whether TCAS is a net benefit or not.
The point being that judging whether TCAS is a good idea or not is not a data-based decision, as Frangible was suggesting it was.

Originally Posted by Spitoon

The fact is that TCAS is here. .... We should use it in the most effective way possible rather than trying to highlight supposed weaknesses and imply that this makes it a 'bad thing'.

Ah, that word "simplistic" comes to mind, along with "straw man".

I said that necessary analysis was missing. And I said that, if I may paraphrase myself, I consider it unwise to go gung-ho-exceptionless for a technology unless the necessary analysis is there to support that decision.

PBL

[PBL]

Originally Posted by Frangible

....... with no TCAS, there would have been no collision. Equally, however, if there had been no ATC, and TCAS only, there would have been no collision.

Both correct. (I omitted the word "axiomatic" since I am unsure what you mean by it.)

Originally Posted by Frangible

This is my point about demarcation – mix up the boundaries and you court disaster.

Now that is an interesting, and likely mistaken, viewpoint.

Boundaries between systems *are* mixed. It is necessary, indeed essential, to study the interactions. And as far as I can tell, that has not been done analytically with TCAS and ATC.

The Eurocontrol ACASA project did a bunch of simulations and analysed them thoroughly, but they did that with about two days' worth of actual data. Unfortunately people have drawn conclusions from that data about system interactions which claim to reach accuracies of one event in O(10**9) operational hours, which mathematically speaking one cannot justify from that limited data. Great project, but there seems to be a human tendency to claim what senior management wants you to claim, rather than to claim what your data support. That is why I like hazard analysis.

Similar happened with the Space Shuttle. Feynman's appendix on risk and hazard analysis to the Challenger report, cited on the Okinawa thread, makes a good read on that topic.

Originally Posted by Frangible

it was by no means clear to me that you were using Ueberlingen as template onto which to put speculative scenarios. Now I see that, this debate becomes less interesting to me. ...... I don’t see how “decision-theoretics” are helping.

Shame. But each to his own. I just wish that more professionals understood how hazard analysis works.

Originally Posted by Frangible

...... you should not go around saying it is unwise to advise pilots always to follow the RA.

It seems to me you are not quite reading what I said. See my reply to Spitoon.

PBL

[Spitoon]

PBL, phrases like 'use of TCAS has almost caused two collisions' and 'he potential outcome at Albany was ameliorated through intervention of a controller' suggest to me that you are reading something into facts (based largely, I presume, on the occurrence investigation reports) - I've always called this analysis and, in this case, it's simplistic. FWIW, I don't equate simplistic with bad, I just like to be aware of the assumptions and aproximations that have been made. Just to be absolutely clear, a statement of fact would be that two aircraft that were within a specific distance of each other generated a TA or RA. The problem with any quantitative analysis designed to assess TCAS effectiveness, or for that matter, the probability of occurrence of some identified failure mode, is that there is no complete data set and thus some assumptions must inevitably made.

The point being that judging whether TCAS is a good idea or not is not a data-based decision, as Frangible was suggesting it was.

If it is not data-based to the extent that the data can be relied upon, and I accept that we could have a lengthy debate about pass/fail criteria etc., what would you base the decision on?

Ah, that word "simplistic" comes to mind, along with "straw man".

Sadly, I think it must be my simplicity but I don't understand your point. All I was saying was that TCAS exists now, just as today's traffic levels exist, and whatever else you might want to cite in the environment in which we operate, and we have to use it as effectively as possible. In order to do so we have to analyse everything we know about it in the best way that we know how. I wasn't suggesting any gung-hoing!

But if I might end with a slightly contentious thought, one of the 'problems' with TCAS was the unilateral way that it was introduced without consideration of the system totality and, if I recall correctly, in a knee-jerk reaction to a mid-air collision. And we are still trying to fix the problems that this created. As I say, we should learn from the past, but it seems to me that, in some respects at least, contemporarily we are seeing a similar course of events over another safety net system, that designed to address runway incursions and the associated risks.

[PBL]

Originally Posted by Spitoon

But if I might end with a slightly contentious thought, one of the 'problems' with TCAS was the unilateral way that it was introduced without consideration of the system totality and, if I recall correctly, in a knee-jerk reaction to a mid-air collision. And we are still trying to fix the problems that this created.

I see we agree on the essentials. My main point is that necessary analysis has still not been done.

Originally Posted by Spitoon

it seems to me that, in some respects at least, contemporarily we are seeing a similar course of events over another safety net system, that designed to address runway incursions and the associated risks.

I don't know enough about that system yet to draw any conclusions. I hope that a similar high-visibility accident does not lead to a similar mandated-intro until the system has been thoroughly analysed.

PBL

[EUROSPIRO]

Why don't we Learn

Even after Uberlingen and all that Eurocontrol and the EU have done for safety and the implementation of Safety Management Systems, most continental center/airports are only paying lip service to safety management. Where NATS takes safety seriously, appointing a Safety Director, there is no ANSP on the continent who does the same. Safety management is present, but buried in processes and in some cases the safety managers are responsible to line managers!!! Wake up Europe and give safety the priority it deserves and start leading from the top, before it happens again. Even the Eurocontrol ATC center in Maastricht does not have a Safety Director at the highest level of management.

[N380UA]

EUROSPIRO; not correct I know for a fact that Skyguide (of all) does have a safety director which reports directly to the board of executives and has the power to assemble the board of directors if necessary.

[EUROSPIRO]

Thanks

Well there is one that has learn't the lesson ...